VPN ASA 2110 clustering

[Amafsha1]

Hello,

I currently have a 2110 running ASA image.  It's used for AnyConnect only.  I have 1 arm on the outside(connected through a L2 switch) and 1 arm on the inside (connected through a L2 switch).  I bought another 2110 and plan to put ASA image on it and cluster it with my current ASA.  Can anyone point me to good documentation around setting this up?  I found some good documentation, but it only seems to be for when connecting to Nexus cores using VPCs and not regular port-channels to a 3750 switch for example. Also none of the documents seem to point to being able to use the cluster control link via a direct connection between the 2 ASAs but instead must go through a switch to do this.  Is it not possible to build the cluster control link by directly connecting cables directly from the ASA to the other ASA?

[mabernar · Accepted solution]

You set the priority on one of the ASAs to be the master and it will redirect the traffic to the other devices. It does this because the master will monitor the workload on the other devices and divide up the connections based on the feedback from the other servers in the cluster.

[mabernar]

Also, another good white paper explaining VPN Load balancing. You could also use an outside load balancing device like an F5 or even a Nexus with the ITD feature. The Pros and Cons are discussed here:

https://www.cisco.com/c/en/us/td/docs/security/asa/misc/anyconnect-faq/anyconnect-faq.html#Cisco_Reference.dita_932bcd38-9cb6-49ef-889c-40e57df87c7f

HTH

[Amafsha1]

Thank you for your help, I just have one last question.

This solution is good for load-balancing because the primary VPN that answers to vpn.xyz.com  will give the connection to the other VPN....but let's say that the primary box goes down...what will happen?  Do I also need to configure active/standby on the 2 boxes along with the Load-balancing configs?  Will that work?  

[Amafsha1]

I just checked out your link.  It looks like 

Option 2b: Two to Ten ASAs in Active/Standby with VPN load balancing enabled

will accomodate what I'm trying to do but there is no configuration example or anything.  Thanks again for your help and sending this link.